RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

jakezhang — Tue, 21 Apr 2026 09:02:19 GMT

CDP 7.1.6 with Isilon OneFS v8.2.2.0, AD kerberos enabled.

While installing RangerKMS service, it failed to start up with the following errors:

[root@n04 ~]# less /var/log/ranger/kms/ranger-kms-n04.gz.local-kms.log

2021-06-11 08:30:32,179 INFO org.apache.hadoop.crypto.key.kms.server.KMSWebApp: -------------------------------------------------------------
2021-06-11 08:30:32,181 INFO org.apache.hadoop.crypto.key.kms.server.KMSWebApp: Java runtime version : 1.8.0_232-b09
2021-06-11 08:30:32,185 INFO org.apache.hadoop.crypto.key.kms.server.KMSWebApp: KMS Hadoop Version: 3.1.1.7.1.6.0-297
2021-06-11 08:30:32,185 INFO org.apache.hadoop.crypto.key.kms.server.KMSWebApp: -------------------------------------------------------------
2021-06-11 08:30:32,208 INFO org.apache.ranger.plugin.classloader.RangerPluginClassLoaderUtil: getFilesInDirectory('/opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/ranger-kms/ews/webapp/WEB-INF/classes/lib/ranger-kms-plugin-impl'): adding /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/ranger-kms/ews/webapp/WEB-INF/classes/lib/ranger-kms-plugin-impl/solr-solrj-8.4.1.7.1.6.0-297.jar

<snip>

2021-06-11 08:31:16,787 INFO org.apache.ranger.audit.provider.AuditProviderFactory: RangerAsyncAuditCleanup: Waiting to audit cleanup start signal
2021-06-11 08:31:16,856 ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin
java.lang.IllegalArgumentException: bound must be positive
at java.util.Random.nextInt(Random.java:388)
at org.apache.ranger.plugin.util.RangerRESTClient.<init>(RangerRESTClient.java:124)
at org.apache.ranger.admin.client.RangerAdminRESTClient.init(RangerAdminRESTClient.java:771)
at org.apache.ranger.admin.client.RangerAdminRESTClient.init(RangerAdminRESTClient.java:116)
at org.apache.ranger.plugin.service.RangerBasePlugin.createAdminClient(RangerBasePlugin.java:659)
at org.apache.ranger.plugin.util.PolicyRefresher.<init>(PolicyRefresher.java:93)
at org.apache.ranger.plugin.service.RangerBasePlugin.init(RangerBasePlugin.java:182)
at org.apache.ranger.authorization.kms.authorizer.RangerKMSPlugin.init(RangerKmsAuthorizer.java:347)
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.init(RangerKmsAuthorizer.java:304)
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.<init>(RangerKmsAuthorizer.java:128)
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.<init>(RangerKmsAuthorizer.java:154)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at java.lang.Class.newInstance(Class.java:442)
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.init(RangerKmsAuthorizer.java:71)
at org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer.<init>(RangerKmsAuthorizer.java:51)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at org.apache.hadoop.util.ReflectionUtils.newInstance(ReflectionUtils.java:133)
at org.apache.hadoop.crypto.key.kms.server.KMSWebApp.getAcls(KMSWebApp.java:239)
at org.apache.hadoop.crypto.key.kms.server.KMSWebApp.contextInitialized(KMSWebApp.java:138)
at org.apache.catalina.core.StandardContext.listenerStart(StandardContext.java:4689)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5155)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1412)
at org.apache.catalina.core.ContainerBase$StartChild.call(ContainerBase.java:1402)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
2021-06-11 08:31:16,863 INFO org.apache.ranger.audit.provider.AuditProviderFactory: ==> JVMShutdownHook.run()
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.provider.AuditProviderFactory: JVMShutdownHook: Signalling async audit cleanup to start.
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.provider.AuditProviderFactory: JVMShutdownHook: Waiting up to 30 seconds for audit cleanup to finish.
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.provider.AuditProviderFactory: RangerAsyncAuditCleanup: Starting cleanup
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.destination.HDFSAuditDestination: Flush called. name=kms.async.summary.multi_dest.batch.hdfs
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.queue.AuditAsyncQueue: Stop called. name=kms.async
2021-06-11 08:31:16,864 INFO org.apache.ranger.audit.queue.AuditAsyncQueue: Interrupting consumerThread. name=kms.async, consumer=kms.async.summary
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: RangerAsyncAuditCleanup: Done cleanup
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: RangerAsyncAuditCleanup: Waiting to audit cleanup start signal
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: JVMShutdownHook: Audit cleanup finished after 1 milli seconds
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: JVMShutdownHook: Interrupting ranger async audit cleanup thread
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: <== JVMShutdownHook.run()
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.provider.AuditProviderFactory: RangerAsyncAuditCleanup: Interrupted while waiting for audit startCleanup signal! Exiting the thread...
java.lang.InterruptedException
at java.util.concurrent.locks.AbstractQueuedSynchronizer.doAcquireSharedInterruptibly(AbstractQueuedSynchronizer.java:998)
at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireSharedInterruptibly(AbstractQueuedSynchronizer.java:1304)
at java.util.concurrent.Semaphore.acquire(Semaphore.java:312)
at org.apache.ranger.audit.provider.AuditProviderFactory$RangerAsyncAuditCleanup.run(AuditProviderFactory.java:506)
at java.lang.Thread.run(Thread.java:748)
2021-06-11 08:31:16,865 INFO org.apache.ranger.audit.queue.AuditAsyncQueue: Caught exception in consumer thread. Shutdown might be in progress

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

Scharan — Fri, 11 Jun 2021 01:19:31 GMT

@jakezhang Can you try adding ranger url in

"Ranger KMS Server Advanced Configuration Snippet (Safety Valve) for conf/ranger-kms-security.xml” ranger.plugin.kms.policy.rest.url=http://<rangerhostname>:<port no>

Also, make sure that DB for ranger and ranger kms are separate

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

jakezhang — Fri, 11 Jun 2021 01:24:20 GMT

Thank you!

yes, I created separated DBs for Ranger and RangerKMS.

will try ""Ranger KMS Server Advanced Configuration Snippet (Safety Valve) for conf/ranger-kms-security.xml” ranger.plugin.kms.policy.rest.url=http://<rangerhostname>:<port no>" and see if it works.

Best regards,

Jake Zhang

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

jakezhang — Fri, 11 Jun 2021 01:43:58 GMT

@Scharan Appreciated your great help!

After adding ranger.plugin.kms.policy.rest.url :

Ranger KMS server started up ...

Thanks again!

Best regards,

Jake Zhang

question Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive in Support Questions

RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive

Re: RangerKMS failed to start up with ERROR org.apache.ranger.authorization.kms.authorizer.RangerKmsAuthorizer: Error Enabling RangerKMSPlugin java.lang.IllegalArgumentException: bound must be positive